Malware Analysis Report

2025-08-05 16:59

Sample ID 240108-d8cpvabec2
Target 4a576229508cc4de24c7d206662a50ec
SHA256 d511989fa3f11bf8e3516fd48be81a6bd50359dce2a3677945d5f90b17776895
Tags
score
7/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
7/10

SHA256

d511989fa3f11bf8e3516fd48be81a6bd50359dce2a3677945d5f90b17776895

Threat Level: Shows suspicious behavior

The file 4a576229508cc4de24c7d206662a50ec was found to be: Shows suspicious behavior.

Malicious Activity Summary


Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Drops file in System32 directory

Enumerates physical storage devices

Unsigned PE

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-01-08 03:40

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-01-08 03:40

Reported

2024-01-08 03:42

Platform

win7-20231215-en

Max time kernel

121s

Max time network

122s

Command Line

"C:\Users\Admin\AppData\Local\Temp\4a576229508cc4de24c7d206662a50ec.exe"

Signatures

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\8aff65ff.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\20b444a7.dll C:\Users\Admin\AppData\Local\Temp\4a576229508cc4de24c7d206662a50ec.exe N/A
File opened for modification C:\Windows\SysWOW64\20b444a7.dll C:\Users\Admin\AppData\Local\Temp\4a576229508cc4de24c7d206662a50ec.exe N/A

Enumerates physical storage devices

Processes

C:\Users\Admin\AppData\Local\Temp\4a576229508cc4de24c7d206662a50ec.exe

"C:\Users\Admin\AppData\Local\Temp\4a576229508cc4de24c7d206662a50ec.exe"

C:\Users\Admin\AppData\Local\Temp\8aff65ff.exe

"C:\Users\Admin\AppData\Local\Temp\8aff65ff.exe"

Network

N/A

Files

memory/1732-0-0x0000000000400000-0x0000000000409000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-01-08 03:40

Reported

2024-01-08 03:43

Platform

win10v2004-20231215-en

Max time kernel

150s

Max time network

156s

Command Line

"C:\Users\Admin\AppData\Local\Temp\4a576229508cc4de24c7d206662a50ec.exe"

Signatures

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\4a576229508cc4de24c7d206662a50ec.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\9564556e.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\b89721c1.dll C:\Users\Admin\AppData\Local\Temp\4a576229508cc4de24c7d206662a50ec.exe N/A
File opened for modification C:\Windows\SysWOW64\b89721c1.dll C:\Users\Admin\AppData\Local\Temp\4a576229508cc4de24c7d206662a50ec.exe N/A

Enumerates physical storage devices

Processes

C:\Users\Admin\AppData\Local\Temp\4a576229508cc4de24c7d206662a50ec.exe

"C:\Users\Admin\AppData\Local\Temp\4a576229508cc4de24c7d206662a50ec.exe"

C:\Users\Admin\AppData\Local\Temp\9564556e.exe

"C:\Users\Admin\AppData\Local\Temp\9564556e.exe"

Network

Country Destination Domain Proto
US 138.91.171.81:80 tcp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.200:443 g.bing.com tcp
US 8.8.8.8:53 23.177.190.20.in-addr.arpa udp
US 8.8.8.8:53 173.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 208.194.73.20.in-addr.arpa udp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp
US 8.8.8.8:53 9.228.82.20.in-addr.arpa udp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 8.8.8.8:53 146.78.124.51.in-addr.arpa udp
US 8.8.8.8:53 59.128.231.4.in-addr.arpa udp
US 8.8.8.8:53 41.110.16.96.in-addr.arpa udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 104.241.123.92.in-addr.arpa udp
US 8.8.8.8:53 119.110.54.20.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 176.178.17.96.in-addr.arpa udp
GB 96.17.178.194:80 tcp
GB 96.17.178.211:80 tcp
US 8.8.8.8:53 udp
GB 96.17.178.174:80 tcp
GB 96.17.178.174:80 tcp
US 8.8.8.8:53 udp
GB 96.17.178.194:80 tcp
GB 96.16.110.114:80 tcp
US 8.8.8.8:53 udp
US 8.8.8.8:53 udp
GB 96.17.178.174:80 tcp
US 8.8.8.8:53 udp
GB 96.17.178.174:80 tcp
GB 88.221.135.211:80 tcp
US 8.8.8.8:53 udp
GB 88.221.135.211:80 tcp
GB 88.221.135.211:80 tcp
GB 88.221.135.211:80 tcp
US 8.8.8.8:53 udp
N/A 52.111.236.23:443 tcp
US 8.8.8.8:53 udp
GB 88.221.135.211:80 tcp
GB 88.221.135.211:80 tcp
GB 88.221.135.211:80 tcp
GB 88.221.135.211:80 tcp
GB 88.221.135.211:80 tcp
GB 88.221.135.211:80 tcp
GB 88.221.135.211:80 tcp
GB 88.221.135.211:80 tcp
GB 88.221.135.211:80 tcp
GB 88.221.135.211:80 tcp
US 8.8.8.8:53 udp
US 8.8.8.8:53 udp
US 8.8.8.8:53 udp
US 8.8.8.8:53 udp
GB 96.17.178.211:80 tcp
GB 96.17.178.211:80 tcp
US 8.8.8.8:53 79.121.231.20.in-addr.arpa udp
US 8.8.8.8:53 122.10.44.20.in-addr.arpa udp

Files

memory/1760-0-0x0000000000400000-0x0000000000409000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\9564556e.exe

MD5 ee33f6c50cf97530173ad593e17430ff
SHA1 d7f569936877cc8e9f4d2814f663d7c1300944c2
SHA256 aae4d4a74b16c3067b5afd72e7a483f08baa2ff072d38bd4adcd5aae2018559d
SHA512 31e6d3751d73c667c62cc78dcb1ea621165a92827e8667a4b556d11dce951c908eaac5cb8ffdea610027e8c88d2160b29d637cf00b7450a985b9e7da52910ad9